CVE-2023-40281

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-40281

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-40281.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-40281

Published

2023-08-17T06:37:01Z

Modified

2026-10-28T02:30:23Z

Summary

[none]

Details

EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the other administrator or the user who accessed the website using the product.

Database specific

{
    "cna_assigner":  "jpcert",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40281.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "2.11.0 to 2.17.2-p1"
                        },
                        {
                            "last_affected":  "2.11.0 to 2.17.2-p1"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandaloneSingleVersion"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/ec-cube/ec-cube

Affected ranges

Type

GIT

Repo

https://github.com/ec-cube/ec-cube

Events

Introduced

1004363cf13cc929c0e077c0ac849a6d3c8c10bb

Last Affected

13dfb352e47c6f231ead5e5b62dc0ec11e354789

Introduced

e2547e2d1775ceacd7c73e1b72d5512efcdb45e7

Last Affected

92fe8f744181641bb8ce0db28b988b089004fbfa

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.11.0"
                },
                {
                    "last_affected":  "2.11.5"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.12.0"
                },
                {
                    "last_affected":  "2.12.6"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-40281.json"

Git / github.com/ec-cube/ec-cube2

Affected ranges

Type

GIT

Repo

https://github.com/ec-cube/ec-cube2

Events

Introduced

1004363cf13cc929c0e077c0ac849a6d3c8c10bb

Last Affected

13dfb352e47c6f231ead5e5b62dc0ec11e354789

Introduced

e2547e2d1775ceacd7c73e1b72d5512efcdb45e7

Last Affected

92fe8f744181641bb8ce0db28b988b089004fbfa

Introduced

9d428d236baa44358f56a38b3ba336222535f7fd

Fixed

25e9c8c90ed17ce6857b78570e403bfa11095941

Introduced

0f4bf44ed1980ed45b18fc4dfa1543f51c57c48e

Fixed

eb43f49065a0e5f6c5367a5d2ae5fd994a5e3bb5

Introduced

25e9c8c90ed17ce6857b78570e403bfa11095941

Last Affected

073dbc8d37086bcb13bc8460cd244ccffa1830ac

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.11.0"
                },
                {
                    "last_affected":  "2.11.5"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.12.0"
                },
                {
                    "last_affected":  "2.12.6"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.13.0"
                },
                {
                    "fixed":  "2.13.5"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:ec-cube:ec-cube:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.17.0"
                },
                {
                    "fixed":  "2.17.2"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:ec-cube:ec-cube:2.13.5:-:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.13.5-NA"
                },
                {
                    "last_affected":  "2.13.5-NA"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:ec-cube:ec-cube:2.13.5:patch1:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.13.5-patch1"
                },
                {
                    "last_affected":  "2.13.5-patch1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:ec-cube:ec-cube:2.17.2:-:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.17.2-NA"
                },
                {
                    "last_affected":  "2.17.2-NA"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:ec-cube:ec-cube:2.17.2:patch1:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.17.2-patch1"
                },
                {
                    "last_affected":  "2.17.2-patch1"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

2.*

2.13.5-NA

2.13.5-patch1

2.17.2-NA

2.17.2-patch1

eccube-2.*

eccube-2.17.0

eccube-2.17.1

eccube-2.17.1-RC

Other

eccube2-weekly-20201110

eccube2-weekly-20201117

eccube2-weekly-20201124

eccube2-weekly-20201201

eccube2-weekly-20201208

eccube2-weekly-20201215

eccube2-weekly-20201222

eccube2-weekly-20201229

eccube2-weekly-20210105

eccube2-weekly-20210112

eccube2-weekly-20210119

eccube2-weekly-20210126

eccube2-weekly-20210202

eccube2-weekly-20210209

eccube2-weekly-20210216

eccube2-weekly-20210223

eccube2-weekly-20210302

eccube2-weekly-20210309

eccube2-weekly-20210316

eccube2-weekly-20210323

eccube2-weekly-20210330

eccube2-weekly-20210406

eccube2-weekly-20210413

eccube2-weekly-20210420

eccube2-weekly-20210427

eccube2-weekly-20210504

eccube2-weekly-20210511

eccube2-weekly-20210525

eccube2-weekly-20210601

eccube2-weekly-20210608

eccube2-weekly-20210615

eccube2-weekly-20210622

eccube2-weekly-20210629

eccube2-weekly-20210706

eccube2-weekly-20210713

eccube2-weekly-20210720

eccube2-weekly-20210727

eccube2-weekly-20210803

eccube2-weekly-20210817

eccube2-weekly-20210824

eccube2-weekly-20210831

eccube2-weekly-20210907

eccube2-weekly-20210914

eccube2-weekly-20210921

eccube2-weekly-20210928

eccube2-weekly-20211005

eccube2-weekly-20211012

eccube2-weekly-20211019

eccube2-weekly-20211026

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-40281.json"